There are yet thousands of these so-called "sandbox" projects that exists. This one sounds rather really wasteful on resources?
Bubblewrap would just be a better alternative for this.
right chain of tought, but systemd is the only to truly leverage linux namespaces capabilities, allowing private networks, other rootfs, etc
bwrap has a lot of sharp edges that can bite you, if you're not aware of them.
bubblewrap is linux only and offers a fraction of isolation of a microvm